Nearly Half of Security Leaders Have Seen Sensitive Data Leak Through AI Tools

Research by security firm BlackFog has found that 47% of security leaders have experienced sensitive data exposure through an AI tool at their organisation. In 77% of those incidents, the tool involved was approved by the company. The researchers said many organisations lack visibility into what data is being shared, even with sanctioned tools. While 62% of respondents could identify which users or departments send data to AI tools, fewer than half (48%) could provide any record of the types of data that left the organisation.

Policy is not the main gap: 98% of organisations have an AI usage policy. Enforcement is the problem. Just over half (56%) back their policies with comprehensive technical controls, while about a third (35%) have a written rule on what staff must not enter into AI prompts but no technical enforcement. Some 39% of security leaders said AI adoption is moving faster than they can govern it, and only 27% of those have comprehensive controls. BlackFog's CEO, Darren Williams, said organisations must also control what information is shared with approved tools.

AI agents add further risk. Over half (56%) said autonomous AI agents acting for employees fall outside existing controls, rising to 70% in technology and telecoms. Only 54% can block or restrict unsanctioned AI tools, and about a third (32%) can detect shadow AI use but cannot consistently stop it.